diff --git a/tests/endpoint/detect_kerberoasting__ssa.test.yml b/tests/endpoint/detect_kerberoasting__ssa.test.yml
new file mode 100644
index 0000000000..8fe47735c1
--- /dev/null
+++ b/tests/endpoint/detect_kerberoasting__ssa.test.yml
@@ -0,0 +1,10 @@
+name: Detect Kerberoasting - SSA Unit test
+detections:
+  - name: Detect kerberoasting
+    file: endpoint/detect_kerberoasting__ssa.yml 
+    pass_condition: '| stats count | where count > 0'
+description: Test detection of kerberoasting
+attack_data:
+  - file_name: T1558.003.json
+    data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1558.003/T1558.003.json
+
diff --git a/tests/endpoint/detect_pass_hash__ssa.test.yml b/tests/endpoint/detect_pass_hash__ssa.test.yml
new file mode 100644
index 0000000000..eec8867003
--- /dev/null
+++ b/tests/endpoint/detect_pass_hash__ssa.test.yml
@@ -0,0 +1,10 @@
+name: Detect Pass the Hash - SSA Unit test
+detections:
+  - name: Detect Pass the Hash
+    file: endpoint/detect_pass_hash__ssa.yml 
+    pass_condition: '| stats count | where count > 0'
+description: Test detection of pass-the-hash
+attack_data:
+  - file_name: T1550.002.json
+    data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1550.002/T1550.002.json
+